Senior IT Internal Controls Analyst

Senior IT Internal Controls Analyst Job Summary The Senior IT Internal Controls Analyst serves as Information Technology’s primary liaison and coordination point for internal audit, external audit, Finance, controller, risk, compliance, cybersecurity, application owners, infrastructure teams, and third-party service providers. The role supports the design, documentation, testing, monitoring, and continuous improvement of IT controls that enable reliable financial reporting and effective technology governance, with particular emphasis on Sarbanes-Oxley (SOX) systems and business-process support. This position coordinates audit requests and evidence, evaluates IT general controls and automated/application controls, supports remediation of deficiencies, and embeds control requirements into key system implementations and significant changes. The analyst provides control-focused oversight across the systems development lifecycle (SDLC), including requirements, design, security, data conversion, interfaces, testing, segregation of duties, deployment, and post-implementation stabilization. Experience with ServiceNow and Microsoft Dynamics 365 Finance and Operations (FinOps) and Project Operations (Proj Ops) is preferred. Key Responsibilities Audit Liaison & Assurance Support · Serve as IT’s central liaison for internal audits, external audits, SOX testing, and other assurance reviews involving enterprise applications, infrastructure, cybersecurity, IT operations, and technology-enabled business processes. · Coordinate audit planning, walkthroughs, interviews, evidence requests, sample selections, demonstrations, and follow-up activities with control owners and subject-matter experts. · Maintain an organized audit request inventory, ownership matrix, due dates, evidence status, open questions, and escalation path to support accurate and timely responses. · Perform quality reviews of evidence before submission to confirm completeness, accuracy, relevance, appropriate period coverage, and alignment to the control description and test request. · Help translate audit observations into clear technology, process, risk, and business-impact language for IT leaders and control owners. · Build productive working relationships with auditors while protecting data confidentiality, maintaining document control, and ensuring responses are factual and appropriately approved. Sarbanes-Oxley & IT Control Program Support · Support the IT SOX program covering financially relevant systems, supporting technologies, interfaces, reports, data, and business processes. · Coordinate and evaluate IT general controls, including security provisioning, privileged access, user access reviews, segregation of duties, change management, computer operations, backup and recovery, inter-system interface monitoring, and incident management. · Support computerized controls, configurable application controls, interface controls, key reports, spreadsheet-dependent controls, and information produced by the entity (IPE) used in financial reporting processes. · Facilitate control-owner walkthroughs; maintain process narratives, flow diagrams, risk and control matrices, control procedures, evidence standards, and testing support documentation. · Assess control design and operating evidence, identify gaps or inconsistent execution, and work with owners to strengthen sustainable controls without creating unnecessary operational burden. · Monitor control performance, exceptions, deficiencies, compensating controls, remediation plans, and management actions; escalate overdue or high-risk matters through established governance channels. · Support annual scoping and change-impact assessments for new systems, significant enhancements, integrations, organizational changes, vendor transitions, and evolving financial processes. System Implementation & SDLC Audit Readiness · Provide risk and control support for major system implementations, upgrades, migrations, integrations, and transformation programs from initiation through post-go-live stabilization. · Participate in project governance and SDLC quality gates to confirm that financial reporting, security, access, privacy, data, auditability, records retention, and control requirements are identified and traceable. · Review control-relevant project artifacts, including business and technical requirements, solution designs, role designs, segregation-of-duties analyses, interface specifications, data migration, conversion plans, user acceptance testing, test documentation, defect disposition, deployment approvals, and support-transition documentation. · Assess whether implementation controls address configuration, master data, opening balances, data conversion completeness and accuracy, interfaces, workflow approvals, key reports, reconciliations, and cutover activities. · Coordinate audit participation in projects and maintain an implementation assurance plan that identifies key risks, required evidence, decision